elasticsearch – Cannot send logs from Logstash to Elastic Search

I deployed ELK Stack to k8s by using helm. In the cluster, Elasticsearch, Kibana and Filebeat are running. I also configured Logstash to send Filebeat logs and logs from external resource.

My external resource is running in another server so I created logstash service as nodePort from 30123. Here is my values.yaml for logstash.

  logstash.yml: |
  pipelines.yml: |
    # This file is where you define your pipelines. You can define multiple.
    # For more information on multiple pipelines, see the documentation:
    #   https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html
    - pipeline.id: logstash
      path.config: "/usr/share/logstash/pipeline/logstash.conf"
    - pipeline.id: devopsdashboard
      path.config: "/usr/share/logstash/pipeline/devopsdashboard.conf"
#  log4j2.properties: |
#    key = value

# Allows you to add any pipeline files in /usr/share/logstash/pipeline/
### ***warn*** there is a hardcoded logstash.conf in the image, override it first
  logstash.conf: |
    input {
      beats {
        port => 5044
    filter {
    output {
      elasticsearch {
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        hosts => [ "elasticsearch-master:9200" ]
  devopsdashboard.conf: |
    input {
       tcp {
         host => ""
         port => 30123
         codec => "json_lines"
    filter {
       mutate {
          remove_field => ["host", "port"]
    output {
      elasticsearch {
        index => "logstash-%{+YYYY.MM.dd}"
        hosts => [ "elasticsearch-master:9200" ]

When I want to create index on Kibana, I can see filebeat index but cannot see logstash. If curl to elastic inside of logstash pod, my index is created but if I try to send logs by tcp via logstash, nothing happens. Do you have any ideas that how I can send logs from logtash to elastic?

I tried a python script to send logs by tcp from my local and I received “400 Bad Request”. I do not know what I am doing wrong. Here is my python script.

import socket
import json
import logging
from datetime import datetime
import sys

print("starting to send data to Elastic search")
# Create TCP/IP socket
print("Creating TCP/IP socket")
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
message = []
    # Connect to port where server is running
    server_address = ('Cluster_IP', 30123)
    data = {'@test' : 'test1', '@message': 'python test message', '@tags': ['python', 'test']}
except socket.error as e:

Thanks a lot!

Read more here: Source link